> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/network-security/container-network-exposure/container-network-exposure-overview.md). # Overview of Container Network Exposure With the addition of Kubernetes services, CNA correlates the data from the VPC configuration (overlay) with the data of the Kubernetes network configuration (underlay) to establish the full path from the internet to the Kubernetes service exposed and the underlying deployment or endpoints associated with the exposed Kubernetes service. Prisma Cloud Satellite is a lightweight and non-intrusive Kubernetes operator, which enables you to manage other Prisma Cloud applications lifecycle. The Satellite automatically deploys the Discovery application, which is used by Prisma Cloud to ingest Kubernetes artifacts for analysis by CNA. For the container exposure use case, Prisma Cloud correlates the Kubernetes configuration with the VPC network information to determine which Kubernetes components are internet exposed, the deployments and endpoints behind each service, and then builds a network graph to display the network path. Once Prisma Cloud ingests the assets from both the Kubernetes clusters and cloud accounts, CNA can find the full path from the internet to the service or pod and determine the inbound exposure (internet) by using the following workflow: * Identify all Kubernetes services in a given cluster. * Extract the Kubernetes service configuration. * Map the associated deployment, endpoint, or network security policy with each Kubernetes service. * Extract the deployment or endpoint configuration. * Map the Kubernetes cluster and nodes with each Kubernetes service. * Find the associated load balancer and VPC configuration. * Calculate if the nodes are internet exposed through the configured protocol and port of the service. * Attach the underlay configuration (VPC level) with the overlay configuration (Kubernetes level) to determine the end-to-end exposure. CNA supports only inbound calculation. The data refresh or ingestion occurs once every 24 hours and alerts are near real time. The Kubernetes exposure only evaluates 'LoadBalancer' type Kubernetes services. Other types of Kubernetes service, such as ClusterIP, NodePort, ExternalName, and Headless are not considered for internet exposure evaluation. Prisma Cloud does not support the following for Container Exposure: * AWS Classic Load Balancers * Red Hat Openshift clusters * Non-Kubernetes based orchestration platforms (AWS ECS, Azure WebApp/Container Instances, GCP Cloud Run) * Clusters not-onboarded on Prisma Cloud * On-premises Kubernetes clusters * Ingress controllers * Cilium Network Policies --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/administration/network-security/container-network-exposure/container-network-exposure-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.